@agentguard-run/spend 0.1.7 → 0.1.9

package/dist/adapters/postgres-store.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Postgres-backed SpendStore + DecisionLogStore.
+ *
+ * Install: `npm install @agentguard-run/spend pg`
+ *
+ * UPSERT semantics for window spend. Append-only decision log table
+ * with UNIQUE(signer_fingerprint, sequence) for crash-safe chain ordering.
+ *
+ * @example
+ *   import { Pool } from 'pg';
+ *   import {
+ *     PostgresSpendStore, PostgresDecisionLogStore, ensureSchema,
+ *   } from '@agentguard-run/spend/dist/adapters/postgres-store';
+ *
+ *   const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ *   await ensureSchema(pool);
+ *   const config = {
+ *     policy,
+ *     spendStore: new PostgresSpendStore(pool),
+ *     logStore: new PostgresDecisionLogStore(pool),
+ *     signingKeys: { privateKey, publicKey },
+ *   };
+ */
+import type { SignedDecisionLogEntry, SpendStore, DecisionLogStore, SpendWindow } from '../types';
+type PoolLike = {
+    query(text: string, params?: any[]): Promise<{
+        rows: any[];
+        rowCount: number | null;
+    }>;
+};
+/** Create the required tables/indexes if they don't exist. Idempotent. */
+export declare function ensureSchema(pool: PoolLike): Promise<void>;
+export declare class PostgresSpendStore implements SpendStore {
+    private pool;
+    constructor(pool: PoolLike);
+    getWindowSpend(scopeKey: string, window: SpendWindow): Promise<number>;
+    incrementWindowSpend(scopeKey: string, window: SpendWindow, cents: number): Promise<number>;
+}
+export declare class PostgresDecisionLogStore implements DecisionLogStore {
+    private pool;
+    constructor(pool: PoolLike);
+    append(entry: SignedDecisionLogEntry): Promise<void>;
+    getLatest(): Promise<SignedDecisionLogEntry | null>;
+    read(fromSequence: number, limit: number): Promise<SignedDecisionLogEntry[]>;
+}
+export {};
+//# sourceMappingURL=postgres-store.d.ts.map

package/dist/adapters/postgres-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.d.ts","sourceRoot":"","sources":["../../src/adapters/postgres-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAElG,KAAK,QAAQ,GAAG;IACd,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACxF,CAAC;AA6BF,0EAA0E;AAC1E,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhE;AAED,qBAAa,kBAAmB,YAAW,UAAU;IACvC,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,QAAQ;IAC5B,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQtE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYlG;AAED,qBAAa,wBAAyB,YAAW,gBAAgB;IACnD,OAAO,CAAC,IAAI;gBAAJ,IAAI,EAAE,QAAQ;IAC5B,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAepD,SAAS,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAQnD,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;CAQnF"}

package/dist/adapters/postgres-store.js

@@ -0,0 +1,122 @@
+"use strict";
+/**
+ * Postgres-backed SpendStore + DecisionLogStore.
+ *
+ * Install: `npm install @agentguard-run/spend pg`
+ *
+ * UPSERT semantics for window spend. Append-only decision log table
+ * with UNIQUE(signer_fingerprint, sequence) for crash-safe chain ordering.
+ *
+ * @example
+ *   import { Pool } from 'pg';
+ *   import {
+ *     PostgresSpendStore, PostgresDecisionLogStore, ensureSchema,
+ *   } from '@agentguard-run/spend/dist/adapters/postgres-store';
+ *
+ *   const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ *   await ensureSchema(pool);
+ *   const config = {
+ *     policy,
+ *     spendStore: new PostgresSpendStore(pool),
+ *     logStore: new PostgresDecisionLogStore(pool),
+ *     signingKeys: { privateKey, publicKey },
+ *   };
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresDecisionLogStore = exports.PostgresSpendStore = void 0;
+exports.ensureSchema = ensureSchema;
+const store_memory_1 = require("../store-memory");
+function _nowMs() { return Date.now(); }
+const SPEND_SCHEMA = `
+CREATE TABLE IF NOT EXISTS agentguard_spend (
+    scope_key       TEXT NOT NULL,
+    window          TEXT NOT NULL,
+    window_start_ms BIGINT NOT NULL,
+    cents           BIGINT NOT NULL DEFAULT 0,
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (scope_key, window, window_start_ms)
+);
+CREATE INDEX IF NOT EXISTS agentguard_spend_updated_idx ON agentguard_spend(updated_at);
+`;
+const LOG_SCHEMA = `
+CREATE TABLE IF NOT EXISTS agentguard_decision_log (
+    id                  BIGSERIAL PRIMARY KEY,
+    sequence            BIGINT NOT NULL,
+    signer_fingerprint  TEXT NOT NULL,
+    entry_hash          TEXT NOT NULL,
+    previous_hash       TEXT NOT NULL,
+    signature           TEXT NOT NULL,
+    decision_json       JSONB NOT NULL,
+    appended_at         TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE (signer_fingerprint, sequence)
+);
+CREATE INDEX IF NOT EXISTS agentguard_log_signer_idx ON agentguard_decision_log(signer_fingerprint, sequence DESC);
+`;
+/** Create the required tables/indexes if they don't exist. Idempotent. */
+async function ensureSchema(pool) {
+    await pool.query(SPEND_SCHEMA);
+    await pool.query(LOG_SCHEMA);
+}
+class PostgresSpendStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async getWindowSpend(scopeKey, window) {
+        const startMs = (0, store_memory_1.windowStart)(window, _nowMs());
+        const r = await this.pool.query('SELECT cents FROM agentguard_spend WHERE scope_key=$1 AND window=$2 AND window_start_ms=$3', [scopeKey, window, startMs]);
+        return r.rows[0] ? Number(r.rows[0].cents) : 0;
+    }
+    async incrementWindowSpend(scopeKey, window, cents) {
+        const startMs = (0, store_memory_1.windowStart)(window, _nowMs());
+        const r = await this.pool.query(`INSERT INTO agentguard_spend (scope_key, window, window_start_ms, cents)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (scope_key, window, window_start_ms)
+       DO UPDATE SET cents = agentguard_spend.cents + EXCLUDED.cents, updated_at = NOW()
+       RETURNING cents`, [scopeKey, window, startMs, cents]);
+        return Number(r.rows[0].cents);
+    }
+}
+exports.PostgresSpendStore = PostgresSpendStore;
+class PostgresDecisionLogStore {
+    pool;
+    constructor(pool) {
+        this.pool = pool;
+    }
+    async append(entry) {
+        await this.pool.query(`INSERT INTO agentguard_decision_log
+         (sequence, signer_fingerprint, entry_hash, previous_hash, signature, decision_json)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb)`, [
+            entry.sequence,
+            entry.signerFingerprint,
+            entry.entryHash,
+            entry.previousHash,
+            entry.signature,
+            JSON.stringify(entry.decision),
+        ]);
+    }
+    async getLatest() {
+        const r = await this.pool.query(`SELECT sequence, signer_fingerprint, entry_hash, previous_hash, signature, decision_json
+       FROM agentguard_decision_log ORDER BY id DESC LIMIT 1`);
+        if (!r.rows[0])
+            return null;
+        return rowToEntry(r.rows[0]);
+    }
+    async read(fromSequence, limit) {
+        const r = await this.pool.query(`SELECT sequence, signer_fingerprint, entry_hash, previous_hash, signature, decision_json
+       FROM agentguard_decision_log WHERE sequence >= $1 ORDER BY sequence ASC LIMIT $2`, [fromSequence, limit]);
+        return r.rows.map(rowToEntry);
+    }
+}
+exports.PostgresDecisionLogStore = PostgresDecisionLogStore;
+function rowToEntry(row) {
+    return {
+        sequence: Number(row.sequence),
+        signerFingerprint: row.signer_fingerprint,
+        entryHash: row.entry_hash,
+        previousHash: row.previous_hash,
+        signature: row.signature,
+        decision: row.decision_json,
+    };
+}
+//# sourceMappingURL=postgres-store.js.map

package/dist/adapters/postgres-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-store.js","sourceRoot":"","sources":["../../src/adapters/postgres-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAuCH,oCAGC;AAxCD,kDAA8C;AAE9C,SAAS,MAAM,KAAa,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAOhD,MAAM,YAAY,GAAG;;;;;;;;;;CAUpB,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;;;;;;;;CAalB,CAAC;AAEF,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,MAAa,kBAAkB;IACT;IAApB,YAAoB,IAAc;QAAd,SAAI,GAAJ,IAAI,CAAU;IAAG,CAAC;IACtC,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAmB;QACxD,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC7B,4FAA4F,EAC5F,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAC5B,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,MAAmB,EAAE,KAAa;QAC7E,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC7B;;;;uBAIiB,EACjB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CACnC,CAAC;QACF,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;CACF;AAtBD,gDAsBC;AAED,MAAa,wBAAwB;IACf;IAApB,YAAoB,IAAc;QAAd,SAAI,GAAJ,IAAI,CAAU;IAAG,CAAC;IACtC,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;8CAEwC,EACxC;YACE,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,iBAAiB;YACvB,KAAK,CAAC,SAAS;YACf,KAAK,CAAC,YAAY;YAClB,KAAK,CAAC,SAAS;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC;SAC/B,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS;QACb,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC7B;6DACuD,CACxD,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAoB,EAAE,KAAa;QAC5C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAC7B;wFACkF,EAClF,CAAC,YAAY,EAAE,KAAK,CAAC,CACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;CACF;AAjCD,4DAiCC;AAED,SAAS,UAAU,CAAC,GAAQ;IAC1B,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,iBAAiB,EAAE,GAAG,CAAC,kBAAkB;QACzC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,aAAa;KAC5B,CAAC;AACJ,CAAC"}

package/dist/adapters/redis-store.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Redis-backed SpendStore + DecisionLogStore.
+ *
+ * Install: `npm install @agentguard-run/spend ioredis`
+ *
+ * Multi-process spend tracking via INCR semantics. Decision log stored
+ * on a Redis Stream for crash-safe ordered append.
+ *
+ * @example
+ *   import Redis from 'ioredis';
+ *   import { RedisSpendStore, RedisDecisionLogStore } from '@agentguard-run/spend/dist/adapters/redis-store';
+ *
+ *   const redis = new Redis('redis://localhost:6379');
+ *   const config = {
+ *     policy,
+ *     spendStore: new RedisSpendStore(redis, { keyPrefix: 'agentguard' }),
+ *     logStore: new RedisDecisionLogStore(redis, { streamKey: 'agentguard:log' }),
+ *     signingKeys: { privateKey, publicKey },
+ *   };
+ */
+import type { SignedDecisionLogEntry, SpendStore, DecisionLogStore, SpendWindow } from '../types';
+type RedisLike = {
+    get(key: string): Promise<string | null>;
+    incrby(key: string, increment: number): Promise<number>;
+    expire(key: string, seconds: number): Promise<number>;
+    xadd(key: string, ...args: any[]): Promise<string | null>;
+    xrevrange(key: string, end: string, start: string, ...args: any[]): Promise<any>;
+    xrange(key: string, start: string, end: string, ...args: any[]): Promise<any>;
+};
+export interface RedisSpendStoreOptions {
+    keyPrefix?: string;
+}
+export declare class RedisSpendStore implements SpendStore {
+    private redis;
+    private prefix;
+    constructor(redis: RedisLike, opts?: RedisSpendStoreOptions);
+    private key;
+    getWindowSpend(scopeKey: string, window: SpendWindow): Promise<number>;
+    incrementWindowSpend(scopeKey: string, window: SpendWindow, cents: number): Promise<number>;
+}
+export interface RedisDecisionLogStoreOptions {
+    streamKey?: string;
+}
+export declare class RedisDecisionLogStore implements DecisionLogStore {
+    private redis;
+    private stream;
+    constructor(redis: RedisLike, opts?: RedisDecisionLogStoreOptions);
+    append(entry: SignedDecisionLogEntry): Promise<void>;
+    getLatest(): Promise<SignedDecisionLogEntry | null>;
+    read(fromSequence: number, limit: number): Promise<SignedDecisionLogEntry[]>;
+}
+export {};
+//# sourceMappingURL=redis-store.d.ts.map

package/dist/adapters/redis-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.d.ts","sourceRoot":"","sources":["../../src/adapters/redis-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAIlG,KAAK,SAAS,GAAG;IACf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAC/E,CAAC;AAUF,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,eAAgB,YAAW,UAAU;IAEpC,OAAO,CAAC,KAAK;IADzB,OAAO,CAAC,MAAM,CAAS;gBACH,KAAK,EAAE,SAAS,EAAE,IAAI,GAAE,sBAA2B;IAGvE,OAAO,CAAC,GAAG;IAIL,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAItE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAMlG;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAsB,YAAW,gBAAgB;IAEhD,OAAO,CAAC,KAAK;IADzB,OAAO,CAAC,MAAM,CAAS;gBACH,KAAK,EAAE,SAAS,EAAE,IAAI,GAAE,4BAAiC;IAGvE,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,SAAS,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAcnD,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;CAsBnF"}

package/dist/adapters/redis-store.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Redis-backed SpendStore + DecisionLogStore.
+ *
+ * Install: `npm install @agentguard-run/spend ioredis`
+ *
+ * Multi-process spend tracking via INCR semantics. Decision log stored
+ * on a Redis Stream for crash-safe ordered append.
+ *
+ * @example
+ *   import Redis from 'ioredis';
+ *   import { RedisSpendStore, RedisDecisionLogStore } from '@agentguard-run/spend/dist/adapters/redis-store';
+ *
+ *   const redis = new Redis('redis://localhost:6379');
+ *   const config = {
+ *     policy,
+ *     spendStore: new RedisSpendStore(redis, { keyPrefix: 'agentguard' }),
+ *     logStore: new RedisDecisionLogStore(redis, { streamKey: 'agentguard:log' }),
+ *     signingKeys: { privateKey, publicKey },
+ *   };
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisDecisionLogStore = exports.RedisSpendStore = void 0;
+const store_memory_1 = require("../store-memory");
+function _nowMs() { return Date.now(); }
+const WINDOW_EXPIRY_S = {
+    per_call: 60,
+    per_minute: 120,
+    per_hour: 7200,
+    per_day: 172800,
+    per_month: 5356800,
+};
+class RedisSpendStore {
+    redis;
+    prefix;
+    constructor(redis, opts = {}) {
+        this.redis = redis;
+        this.prefix = opts.keyPrefix ?? 'agentguard';
+    }
+    key(scopeKey, window) {
+        const startMs = (0, store_memory_1.windowStart)(window, _nowMs());
+        return `${this.prefix}:spend:${scopeKey}:${window}:${startMs}`;
+    }
+    async getWindowSpend(scopeKey, window) {
+        const v = await this.redis.get(this.key(scopeKey, window));
+        return v ? parseInt(v, 10) : 0;
+    }
+    async incrementWindowSpend(scopeKey, window, cents) {
+        const k = this.key(scopeKey, window);
+        const newVal = await this.redis.incrby(k, cents);
+        await this.redis.expire(k, WINDOW_EXPIRY_S[window] ?? 86400);
+        return newVal;
+    }
+}
+exports.RedisSpendStore = RedisSpendStore;
+class RedisDecisionLogStore {
+    redis;
+    stream;
+    constructor(redis, opts = {}) {
+        this.redis = redis;
+        this.stream = opts.streamKey ?? 'agentguard:log';
+    }
+    async append(entry) {
+        const payload = JSON.stringify(entry);
+        await this.redis.xadd(this.stream, '*', 'd', payload);
+    }
+    async getLatest() {
+        try {
+            const entries = await this.redis.xrevrange(this.stream, '+', '-', 'COUNT', 1);
+            if (!entries || entries.length === 0)
+                return null;
+            // ioredis returns [[id, [field1, val1, field2, val2, ...]], ...]
+            const [, fields] = entries[0];
+            const dIdx = fields.indexOf('d');
+            if (dIdx < 0)
+                return null;
+            const raw = fields[dIdx + 1];
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async read(fromSequence, limit) {
+        try {
+            const entries = await this.redis.xrange(this.stream, '-', '+', 'COUNT', limit * 2);
+            const out = [];
+            for (const [, fields] of entries) {
+                const dIdx = fields.indexOf('d');
+                if (dIdx < 0)
+                    continue;
+                try {
+                    const parsed = JSON.parse(fields[dIdx + 1]);
+                    if (parsed.sequence >= fromSequence) {
+                        out.push(parsed);
+                        if (out.length >= limit)
+                            break;
+                    }
+                }
+                catch {
+                    // skip malformed
+                }
+            }
+            return out;
+        }
+        catch {
+            return [];
+        }
+    }
+}
+exports.RedisDecisionLogStore = RedisDecisionLogStore;
+//# sourceMappingURL=redis-store.js.map

package/dist/adapters/redis-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.js","sourceRoot":"","sources":["../../src/adapters/redis-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAEH,kDAA8C;AAE9C,SAAS,MAAM,KAAa,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAchD,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,GAAG;IACf,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,MAAM;IACf,SAAS,EAAE,OAAO;CACnB,CAAC;AAMF,MAAa,eAAe;IAEN;IADZ,MAAM,CAAS;IACvB,YAAoB,KAAgB,EAAE,OAA+B,EAAE;QAAnD,UAAK,GAAL,KAAK,CAAW;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC;IAC/C,CAAC;IACO,GAAG,CAAC,QAAgB,EAAE,MAAmB;QAC/C,MAAM,OAAO,GAAG,IAAA,0BAAW,EAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,GAAG,IAAI,CAAC,MAAM,UAAU,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAmB;QACxD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,MAAmB,EAAE,KAAa;QAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAnBD,0CAmBC;AAMD,MAAa,qBAAqB;IAEZ;IADZ,MAAM,CAAS;IACvB,YAAoB,KAAgB,EAAE,OAAqC,EAAE;QAAzD,UAAK,GAAL,KAAK,CAAW;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACnD,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAA6B;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,iEAAiE;YACjE,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,YAAoB,EAAE,KAAa;QAC5C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACnF,MAAM,GAAG,GAA6B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,IAAI,GAAG,CAAC;oBAAE,SAAS;gBACvB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAA2B,CAAC;oBACtE,IAAI,MAAM,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;wBACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBACjB,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;4BAAE,MAAM;oBACjC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iBAAiB;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA7CD,sDA6CC"}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6BH,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAqClF"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA8BH,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAyClF"}

package/dist/cli/main.js

@@ -55,6 +55,7 @@ commands:
   init              Scaffold a project (policy.yaml + quickstart + .gitignore).
   doctor            Check installation health and configuration.
   explain           Decode a signed receipt with cap math + signature breakdown.
+  serve             Open a local dashboard at http://localhost:8787.
   --version         Show the installed SDK version.
   --help            Show this help.
 
@@ -99,6 +100,10 @@ async function main(argv = process.argv.slice(2)) {
         const { runExplain } = await Promise.resolve().then(() => __importStar(require('./explain')));
         return runExplain(rest);
     }
+    if (command === 'serve') {
+        const { runServe } = await Promise.resolve().then(() => __importStar(require('./serve')));
+        return runServe(rest);
+    }
     process.stderr.write(`agentguard: unknown command '${command}'\n\n`);
     process.stderr.write(HELP);
     return 2;

package/dist/cli/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BH,oBAqCC;AAhED,oCAAoD;AAEpD,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBZ,CAAC;AAEK,KAAK,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,cAAc,gCAAwB,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,WAAW,GAAC,CAAC;QACjD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,OAAO,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8CAA8C;AAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BH,oBAyCC;AArED,oCAAoD;AAEpD,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBZ,CAAC;AAEK,KAAK,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,cAAc,gCAAwB,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,QAAQ,GAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,UAAU,EAAE,GAAG,wDAAa,WAAW,GAAC,CAAC;QACjD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;QAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,OAAO,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8CAA8C;AAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/cli/serve.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `agentguard serve` — local dashboard at localhost:8787 (configurable).
+ *
+ * Aggregates per-tenant decision logs under ~/.agentguard/<tenant>/decisions.ndjson
+ * + ~/.agentguard/demo/decisions.ndjson and serves a single-page dashboard.
+ *
+ * No outbound network calls. Pure Node stdlib HTTP server.
+ */
+export declare function runServe(argv: string[]): Promise<number>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/cli/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiLH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8G9D"}

package/dist/cli/serve.js

@@ -0,0 +1,334 @@
+"use strict";
+/**
+ * `agentguard serve` — local dashboard at localhost:8787 (configurable).
+ *
+ * Aggregates per-tenant decision logs under ~/.agentguard/<tenant>/decisions.ndjson
+ * + ~/.agentguard/demo/decisions.ndjson and serves a single-page dashboard.
+ *
+ * No outbound network calls. Pure Node stdlib HTTP server.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runServe = runServe;
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const index_1 = require("../index");
+const decision_log_1 = require("../decision-log");
+const colors_1 = require("./colors");
+const AGENTGUARD_HOME = path.join(os.homedir(), '.agentguard');
+function scanLogFiles() {
+    if (!fs.existsSync(AGENTGUARD_HOME))
+        return [];
+    const out = [];
+    for (const entry of fs.readdirSync(AGENTGUARD_HOME, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+            const candidate = path.join(AGENTGUARD_HOME, entry.name, 'decisions.ndjson');
+            if (fs.existsSync(candidate))
+                out.push(candidate);
+        }
+    }
+    return out.sort();
+}
+function loadAllDecisions() {
+    const out = [];
+    for (const logPath of scanLogFiles()) {
+        const tenant = path.basename(path.dirname(logPath));
+        try {
+            const content = fs.readFileSync(logPath, 'utf-8');
+            for (const line of content.split('\n')) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const d = JSON.parse(line);
+                    d._tenant = tenant;
+                    out.push(d);
+                }
+                catch {
+                    // skip malformed line
+                }
+            }
+        }
+        catch {
+            // skip unreadable file
+        }
+    }
+    return out;
+}
+function computeStats(decisions) {
+    const totalCalls = decisions.length;
+    const blockedCount = decisions.filter((d) => d.decision?.action === 'block').length;
+    const downgradeCount = decisions.filter((d) => d.decision?.action === 'downgrade').length;
+    const allowCount = totalCalls - blockedCount - downgradeCount;
+    const spentCents = decisions
+        .filter((d) => ['allow', 'downgrade'].includes(d.decision?.action))
+        .reduce((sum, d) => sum + (d.decision.projectedCents || 0), 0);
+    const savedCents = decisions
+        .filter((d) => d.decision?.action === 'block')
+        .reduce((sum, d) => sum + (d.decision.projectedCents || 0), 0);
+    const byAgent = {};
+    const byProvider = {};
+    for (const d of decisions) {
+        if (!['allow', 'downgrade'].includes(d.decision?.action))
+            continue;
+        const scopeKey = d.decision?.triggeredScopeKey || '';
+        let agentId = 'unknown';
+        for (const part of scopeKey.split('|')) {
+            if (part.startsWith('agentId=')) {
+                agentId = part.slice(8);
+                break;
+            }
+        }
+        byAgent[agentId] = (byAgent[agentId] || 0) + (d.decision.projectedCents || 0);
+        const prov = d.decision.provider || 'unknown';
+        byProvider[prov] = (byProvider[prov] || 0) + (d.decision.projectedCents || 0);
+    }
+    return {
+        totals: {
+            spent_cents: spentCents,
+            saved_cents: savedCents,
+            calls: totalCalls,
+            blocked: blockedCount,
+            downgraded: downgradeCount,
+            allowed: allowCount,
+        },
+        by_agent: Object.entries(byAgent).map(([k, v]) => ({ agent: k, spent_cents: v })).sort((a, b) => b.spent_cents - a.spent_cents),
+        by_provider: Object.entries(byProvider).map(([k, v]) => ({ provider: k, spent_cents: v })).sort((a, b) => b.spent_cents - a.spent_cents),
+        recent: decisions.slice(-50).reverse(),
+        version: index_1.AGENTGUARD_SPEND_VERSION,
+    };
+}
+// Dashboard HTML — IDENTICAL to the Python version so users see the same UI
+// whether they ran `pip install agentguard-spend` or `npm install -g`.
+const DASHBOARD_HTML = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8" />
+<title>AgentGuard Spend · Local Dashboard</title>
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<style>
+:root { --bg:#07101E; --surface:#0C1828; --surface-2:#0F1F35; --border:rgba(42,188,180,0.18); --border-dim:rgba(255,255,255,0.08); --teal:#2abcb4; --teal-glow:rgba(42,188,180,0.15); --text:#FFF; --text-2:#DCE8F0; --muted:#8AA0B3; --green:#4ade80; --amber:#F1C40F; --red:#FF6B6B; --code:#E6F0F5; }
+* { box-sizing: border-box; margin: 0; padding: 0; }
+html, body { background: var(--bg); color: var(--text-2); font-family: 'DM Sans', -apple-system, system-ui, sans-serif; font-size: 15px; min-height: 100vh; -webkit-font-smoothing: antialiased; }
+a { color: var(--teal); text-decoration: none; } a:hover { text-decoration: underline; }
+code, .mono { font-family: 'JetBrains Mono', monospace; font-size: 13px; }
+.topbar { display: flex; align-items: center; justify-content: space-between; padding: 16px 32px; border-bottom: 1px solid var(--border-dim); background: rgba(7,16,30,0.92); backdrop-filter: blur(10px); position: sticky; top: 0; z-index: 50; }
+.brand { display: inline-flex; align-items: center; gap: 12px; }
+.brand .hex { width: 22px; height: 22px; background: var(--teal); color: var(--bg); display: inline-flex; align-items: center; justify-content: center; font-weight: 800; font-size: 13px; border-radius: 4px; }
+.brand .name { font-family: 'Cormorant Garamond', Georgia, serif; font-size: 22px; color: var(--text); }
+.brand .name .accent { color: var(--teal); }
+.brand .tag { margin-left: 8px; font-family: 'JetBrains Mono', monospace; font-size: 10px; font-weight: 700; letter-spacing: 0.15em; text-transform: uppercase; color: var(--teal); padding: 3px 8px; border: 1px solid var(--border); border-radius: 3px; }
+.refresh-btn { font-family: 'JetBrains Mono', monospace; font-size: 12px; color: var(--teal); background: transparent; border: 1px solid var(--teal); border-radius: 4px; padding: 7px 14px; cursor: pointer; }
+.refresh-btn:hover { background: var(--teal-glow); }
+.shell { padding: 32px; max-width: 1280px; margin: 0 auto; }
+.stats-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 16px; margin-bottom: 28px; }
+@media (max-width: 800px) { .stats-row { grid-template-columns: repeat(2, 1fr); } }
+.stat-card { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 18px 20px; }
+.stat-card .label { font-family: 'JetBrains Mono', monospace; font-size: 10px; font-weight: 700; letter-spacing: 0.15em; text-transform: uppercase; color: var(--muted); margin-bottom: 8px; }
+.stat-card .value { font-size: 28px; font-weight: 800; color: var(--text); font-variant-numeric: tabular-nums; letter-spacing: -0.02em; }
+.stat-card.green .value { color: var(--green); }
+.stat-card.red .value { color: var(--red); }
+.stat-card.amber .value { color: var(--amber); }
+.stat-card .sub { color: var(--muted); font-size: 12px; margin-top: 4px; }
+.section { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 24px 26px; margin-bottom: 24px; }
+.section h2 { font-family: 'JetBrains Mono', monospace; font-size: 11px; font-weight: 700; letter-spacing: 0.15em; text-transform: uppercase; color: var(--teal); margin-bottom: 16px; }
+.two-col { display: grid; grid-template-columns: 1fr 1fr; gap: 24px; }
+@media (max-width: 800px) { .two-col { grid-template-columns: 1fr; } }
+.bar-row { display: flex; align-items: center; gap: 12px; padding: 8px 0; border-bottom: 1px solid var(--border-dim); font-size: 13.5px; }
+.bar-row:last-child { border-bottom: none; }
+.bar-row .name { width: 35%; color: var(--text); }
+.bar-row .bar { flex: 1; height: 10px; background: var(--surface-2); border-radius: 2px; overflow: hidden; }
+.bar-row .bar-fill { height: 100%; background: var(--teal); transition: width 0.4s; }
+.bar-row .amount { width: 80px; text-align: right; color: var(--green); font-weight: 700; font-family: 'JetBrains Mono', monospace; font-size: 13px; }
+table { width: 100%; border-collapse: collapse; font-size: 13px; }
+th { text-align: left; padding: 10px 12px; font-family: 'JetBrains Mono', monospace; font-size: 10px; letter-spacing: 0.12em; text-transform: uppercase; color: var(--muted); border-bottom: 1px solid var(--border); }
+td { padding: 12px; border-bottom: 1px solid var(--border-dim); vertical-align: top; }
+td.action-block { color: var(--red); font-weight: 700; }
+td.action-downgrade { color: var(--amber); font-weight: 700; }
+td.action-allow { color: var(--green); }
+td.action-shadow { color: var(--muted); }
+td .mono { color: var(--code); }
+.pill { display: inline-block; padding: 2px 8px; border-radius: 3px; font-family: 'JetBrains Mono', monospace; font-size: 11px; background: var(--surface-2); color: var(--text-2); border: 1px solid var(--border-dim); }
+.empty { text-align: center; padding: 56px 20px; color: var(--muted); font-size: 14px; }
+.empty code { display: block; margin-top: 8px; font-size: 14px; color: var(--teal); }
+.live-indicator { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: var(--green); margin-right: 6px; animation: pulse 2s ease-in-out infinite; }
+@keyframes pulse { 0%, 100% { opacity: 1; box-shadow: 0 0 0 0 rgba(74,222,128,0.4); } 50% { opacity: 0.7; box-shadow: 0 0 0 6px rgba(74,222,128,0); } }
+</style></head><body>
+<div class="topbar">
+  <div class="brand"><span class="hex">⬡</span><span class="name">Agent<span class="accent">Guard</span></span><span class="tag">Spend · Local Dashboard</span></div>
+  <div><span class="mono" style="color: var(--muted); margin-right: 16px;"><span class="live-indicator"></span>v__VERSION__ · localhost:__PORT__</span><button class="refresh-btn" onclick="loadStats()">Refresh</button></div>
+</div>
+<div class="shell">
+  <div class="stats-row">
+    <div class="stat-card green"><div class="label">Spent (all-time)</div><div class="value" id="spent">$0.00</div><div class="sub" id="spent-sub">across <span id="call-count">0</span> calls</div></div>
+    <div class="stat-card red"><div class="label">Saved by blocks</div><div class="value" id="saved">+$0.00</div><div class="sub"><span id="blocked-count">0</span> calls blocked</div></div>
+    <div class="stat-card amber"><div class="label">Downgraded</div><div class="value" id="downgraded">0</div><div class="sub">calls routed to cheaper model</div></div>
+    <div class="stat-card"><div class="label">Allowed</div><div class="value" id="allowed">0</div><div class="sub">policy-checked & passed</div></div>
+  </div>
+  <div class="two-col">
+    <div class="section"><h2>Spend by Agent</h2><div id="by-agent"></div></div>
+    <div class="section"><h2>Spend by Provider</h2><div id="by-provider"></div></div>
+  </div>
+  <div class="section">
+    <h2>Recent Decisions</h2>
+    <table><thead><tr><th style="width:80px">Action</th><th>Agent</th><th>Provider · Model</th><th style="width:120px;text-align:right">Amount</th><th style="width:120px">Receipt</th></tr></thead><tbody id="recent-rows"></tbody></table>
+  </div>
+  <div style="text-align: center; color: var(--muted); font-size: 12px; margin-top: 32px;">Local-only. No outbound network calls. Reads from <code class="mono">~/.agentguard/*/decisions.ndjson</code>.<br/>Source: <a href="https://agentguard.run">agentguard.run</a> · <a href="https://www.npmjs.com/package/@agentguard-run/spend">npm</a> · <a href="https://pypi.org/project/agentguard-spend/">pypi</a></div>
+</div>
+<script>
+function formatCents(cents) { const sign = cents < 0 ? '-' : ''; const abs = Math.abs(Math.round(cents)); const dollars = Math.floor(abs / 100); const remainder = abs % 100; return sign + '$' + dollars.toLocaleString() + '.' + String(remainder).padStart(2, '0'); }
+function renderBars(containerId, items, key) { const el = document.getElementById(containerId); if (!items.length) { el.innerHTML = '<div style="color:var(--muted);font-size:13px;padding:8px 0">no data yet</div>'; return; } const max = Math.max(...items.map(i => i.spent_cents)) || 1; el.innerHTML = items.slice(0, 8).map(i => '<div class="bar-row"><span class="name">' + i[key] + '</span><span class="bar"><span class="bar-fill" style="width:' + (i.spent_cents/max*100).toFixed(1) + '%"></span></span><span class="amount">' + formatCents(i.spent_cents) + '</span></div>').join(''); }
+function renderRecent(items) { const tbody = document.getElementById('recent-rows'); if (!items.length) { tbody.innerHTML = '<tr><td colspan="5"><div class="empty">no decisions yet.<br>run <code>agentguard demo</code> to see a real signed receipt here.</div></td></tr>'; return; } tbody.innerHTML = items.map(d => { const dec = d.decision; const scope = dec.triggeredScopeKey || ''; const agentMatch = scope.match(/agentId=([^|]+)/); const agent = agentMatch ? agentMatch[1] : '<span style="color:var(--muted)">—</span>'; const action = dec.action || 'allow'; return '<tr><td class="action-' + action + '">' + action.toUpperCase() + '</td><td class="mono">' + agent + '</td><td><span class="pill">' + (dec.provider || '?') + '</span> ' + (dec.modelRequested || '') + '</td><td style="text-align:right" class="mono">' + formatCents(dec.projectedCents || 0) + '</td><td class="mono"><a href="#" onclick="return verifyReceipt(\\'' + d.entryHash + '\\')">' + d.entryHash.slice(0, 12) + '...</a></td></tr>'; }).join(''); }
+async function verifyReceipt(hash) { try { const r = await fetch('/api/verify/' + hash); const d = await r.json(); alert(d.ok ? '✓ verified: signature valid, hash matches, chain intact' : '✗ verification failed: ' + (d.reason || 'unknown')); } catch (e) { alert('verify error: ' + e); } return false; }
+async function loadStats() { try { const r = await fetch('/api/stats'); const s = await r.json(); document.getElementById('spent').textContent = formatCents(s.totals.spent_cents); document.getElementById('saved').textContent = '+' + formatCents(s.totals.saved_cents); document.getElementById('downgraded').textContent = s.totals.downgraded; document.getElementById('allowed').textContent = s.totals.allowed; document.getElementById('call-count').textContent = s.totals.calls; document.getElementById('blocked-count').textContent = s.totals.blocked; renderBars('by-agent', s.by_agent, 'agent'); renderBars('by-provider', s.by_provider, 'provider'); renderRecent(s.recent); } catch (e) { console.error('load failed:', e); } }
+loadStats();
+setInterval(loadStats, 5000);
+</script></body></html>
+`;
+async function runServe(argv) {
+    let port = 8787;
+    let host = '127.0.0.1';
+    let noOpen = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--port')
+            port = parseInt(argv[++i] ?? '8787', 10);
+        else if (a === '--host')
+            host = argv[++i] ?? '127.0.0.1';
+        else if (a === '--no-open')
+            noOpen = true;
+        else if (a === '--help' || a === '-h') {
+            console.log('agentguard serve [--port 8787] [--host 127.0.0.1] [--no-open]');
+            return 0;
+        }
+    }
+    console.log('');
+    console.log('  ' + (0, colors_1.banner)(index_1.AGENTGUARD_SPEND_VERSION));
+    console.log('');
+    console.log('  ' + (0, colors_1.cyanBold)('agentguard serve') + (0, colors_1.dim)('  ·  local dashboard'));
+    console.log('');
+    const logFiles = scanLogFiles();
+    if (logFiles.length === 0) {
+        console.log(`  ${(0, colors_1.dim)('no decision logs found yet at ~/.agentguard/*/decisions.ndjson')}`);
+        console.log(`  ${(0, colors_1.dim)('run')} ${(0, colors_1.greenBold)('agentguard demo')} ${(0, colors_1.dim)('to produce one, then refresh.')}`);
+        console.log('');
+    }
+    const server = http.createServer(async (req, res) => {
+        const url = (req.url || '/').split('?')[0];
+        const sendJSON = (status, payload) => {
+            const body = JSON.stringify(payload);
+            res.writeHead(status, {
+                'Content-Type': 'application/json',
+                'Content-Length': Buffer.byteLength(body).toString(),
+                'Cache-Control': 'no-store',
+            });
+            res.end(body);
+        };
+        const sendHTML = (html) => {
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+            res.end(html);
+        };
+        if (url === '/' || url === '/index.html') {
+            sendHTML(DASHBOARD_HTML.replace('__VERSION__', index_1.AGENTGUARD_SPEND_VERSION).replace('__PORT__', String(port)));
+            return;
+        }
+        if (url === '/api/stats') {
+            sendJSON(200, computeStats(loadAllDecisions()));
+            return;
+        }
+        if (url.startsWith('/api/verify/')) {
+            const entryHash = url.split('/').pop();
+            const decisions = loadAllDecisions();
+            const match = decisions.find((d) => d.entryHash === entryHash);
+            if (!match) {
+                sendJSON(404, { ok: false, reason: 'receipt not found' });
+                return;
+            }
+            try {
+                const publicKeyHex = match.publicKeyHex;
+                if (!publicKeyHex) {
+                    sendJSON(400, { ok: false, reason: 'no public key in stored receipt' });
+                    return;
+                }
+                const publicKey = Uint8Array.from(Buffer.from(publicKeyHex, 'hex'));
+                const entry = {
+                    sequence: match.sequence,
+                    entryHash: match.entryHash,
+                    previousHash: match.previousHash,
+                    signature: match.signature,
+                    signerFingerprint: match.signerFingerprint,
+                    decision: match.decision,
+                };
+                const ok = await (0, decision_log_1.verifyEntry)(entry, publicKey);
+                sendJSON(200, { ok: Boolean(ok) });
+            }
+            catch (e) {
+                sendJSON(500, { ok: false, reason: String(e?.message || e) });
+            }
+            return;
+        }
+        sendJSON(404, { error: 'not found' });
+    });
+    const url = `http://${host}:${port}`;
+    server.listen(port, host, () => {
+        console.log(`  ${(0, colors_1.green)('→')} dashboard:  ${(0, colors_1.greenBold)(url)}`);
+        console.log(`  ${(0, colors_1.dim)('  reading:    ~/.agentguard/*/decisions.ndjson')}`);
+        console.log(`  ${(0, colors_1.dim)('  press Ctrl+C to stop')}`);
+        console.log('');
+        if (!noOpen) {
+            setTimeout(() => {
+                try {
+                    const { exec } = require('child_process');
+                    const cmd = process.platform === 'darwin'
+                        ? `open "${url}"`
+                        : process.platform === 'win32'
+                            ? `start "" "${url}"`
+                            : `xdg-open "${url}"`;
+                    exec(cmd);
+                }
+                catch { /* best-effort */ }
+            }, 400);
+        }
+    });
+    process.on('SIGINT', () => {
+        console.log('');
+        console.log(`  ${(0, colors_1.green)('✓')} dashboard stopped`);
+        console.log('');
+        server.close();
+        process.exit(0);
+    });
+    // Keep alive
+    return new Promise(() => { });
+}
+//# sourceMappingURL=serve.js.map

package/dist/cli/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiLH,4BA8GC;AA7RD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,2CAA6B;AAC7B,oCAAoD;AACpD,kDAA8C;AAE9C,qCAAmE;AAEnE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAE/D,SAAS,YAAY;IACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7E,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;YAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC3B,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC3B,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,SAAgB;IACpC,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC;IACpC,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACpF,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IAC1F,MAAM,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,cAAc,CAAC;IAE9D,MAAM,UAAU,GAAG,SAAS;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,SAAS;SACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,SAAS;QACnE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,EAAE,iBAAiB,IAAI,EAAE,CAAC;QACrD,IAAI,OAAO,GAAG,SAAS,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC9C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,OAAO;QACL,MAAM,EAAE;YACN,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,UAAU;SACpB;QACD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QAC/H,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QACxI,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;QACtC,OAAO,EAAE,gCAAwB;KAClC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkFtB,CAAC;AAEK,KAAK,UAAU,QAAQ,CAAC,IAAc;IAC3C,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;aACxD,IAAI,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC;aACpD,IAAI,CAAC,KAAK,WAAW;YAAE,MAAM,GAAG,IAAI,CAAC;aACrC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,eAAM,EAAC,gCAAwB,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,iBAAQ,EAAC,kBAAkB,CAAC,GAAG,IAAA,YAAG,EAAC,sBAAsB,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,YAAG,EAAC,gEAAgE,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,YAAG,EAAC,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,iBAAiB,CAAC,IAAI,IAAA,YAAG,EAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC;QACvG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,OAAY,EAAE,EAAE;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;gBACpB,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBACpD,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;YAChG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACzC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,gCAAwB,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;YACxC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAClF,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gBACxC,IAAI,CAAC,YAAY,EAAE,CAAC;oBAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACvG,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;gBACpE,MAAM,KAAK,GAA2B;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC;gBACF,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAW,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC/C,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,cAAK,EAAC,GAAG,CAAC,gBAAgB,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,YAAG,EAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,YAAG,EAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC;oBACH,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;oBAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBACvC,CAAC,CAAC,SAAS,GAAG,GAAG;wBACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;4BAC5B,CAAC,CAAC,aAAa,GAAG,GAAG;4BACrB,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;oBAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/B,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,cAAK,EAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,aAAa;IACb,OAAO,IAAI,OAAO,CAAS,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export { canonicalJson, sha256Hex, computeEntryHash, computeSignerFingerprint, s
 export { InMemorySpendStore } from './store-memory';
 export { SpendGuard, withSpendGuard, AgentGuardBlockedError, type SpendGuardConfig, type OpenAIBindingOptions, } from './spend-guard';
 export { DEFAULT_LOCALE, SUPPORTED_LOCALES, TRANSLATIONS, type SupportedLocale, resolveLocale, t, formatBlockedTrace, type BlockedTraceArgs, } from './i18n';
-export declare const AGENTGUARD_SPEND_VERSION = "0.1.7";
+export declare const AGENTGUARD_SPEND_VERSION = "0.1.9";
 /** Patent marking. 35 U.S.C. § 287 constructive notice. */
 export declare const PATENT_NOTICE: string;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -46,7 +46,7 @@ Object.defineProperty(exports, "TRANSLATIONS", { enumerable: true, get: function
 Object.defineProperty(exports, "resolveLocale", { enumerable: true, get: function () { return i18n_1.resolveLocale; } });
 Object.defineProperty(exports, "t", { enumerable: true, get: function () { return i18n_1.t; } });
 Object.defineProperty(exports, "formatBlockedTrace", { enumerable: true, get: function () { return i18n_1.formatBlockedTrace; } });
-exports.AGENTGUARD_SPEND_VERSION = '0.1.7';
+exports.AGENTGUARD_SPEND_VERSION = '0.1.9';
 /** Patent marking. 35 U.S.C. § 287 constructive notice. */
 exports.PATENT_NOTICE = 'Protected by U.S. patent-pending technology ' +
     '(App. Nos. 63/983,615; 63/983,621; 63/983,843; 63/984,626; ' +

package/dist/integrations/langchain-callback.d.ts

@@ -0,0 +1,42 @@
+/**
+ * LangChain.js callback handler that fires AgentGuard spend checks before
+ * every LLM call.
+ *
+ * Install: `npm install @agentguard-run/spend @langchain/core`
+ *
+ * @example
+ *   import { ChatOpenAI } from '@langchain/openai';
+ *   import { AgentGuardSpendCallbackHandler } from '@agentguard-run/spend/dist/integrations/langchain-callback';
+ *
+ *   const handler = new AgentGuardSpendCallbackHandler({
+ *     dailyCapDollars: 20,
+ *     agentId: 'my-langchain-agent',
+ *   });
+ *   const llm = new ChatOpenAI({ callbacks: [handler] });
+ *   await llm.invoke('hello');  // throws AgentGuardBlockedError if cap exceeded
+ */
+export interface AgentGuardSpendCallbackHandlerOptions {
+    dailyCapDollars: number;
+    agentId?: string;
+    tenantId?: string;
+    softCapDollars?: number;
+    downgradeTo?: string;
+    perMinuteCapDollars?: number;
+}
+/**
+ * LangChain.js BaseCallbackHandler-compatible class. We declare it without
+ * extending the real BaseCallbackHandler (which would require a peer-dep
+ * import at module load), and let LangChain duck-type it via the standard
+ * callback method names.
+ */
+export declare class AgentGuardSpendCallbackHandler {
+    name: string;
+    private policy;
+    private scope;
+    private spendStore;
+    constructor(opts: AgentGuardSpendCallbackHandlerOptions);
+    handleChatModelStart(llm: any, messages: any[][], _runId: string, _parentRunId: string | undefined, extraParams?: Record<string, any>): Promise<void>;
+    handleLLMStart(_llm: any, prompts: string[], _runId: string, _parentRunId: string | undefined, extraParams?: Record<string, any>): Promise<void>;
+    private preflight;
+}
+//# sourceMappingURL=langchain-callback.d.ts.map

package/dist/integrations/langchain-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain-callback.d.ts","sourceRoot":"","sources":["../../src/integrations/langchain-callback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH,MAAM,WAAW,qCAAqC;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,IAAI,SAAsB;IAC1B,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,UAAU,CAAqB;gBAE3B,IAAI,EAAE,qCAAqC;IA2CjD,oBAAoB,CACxB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,GAAG,EAAE,EAAE,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;IAaV,cAAc,CAClB,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC;YAWF,SAAS;CAiBxB"}

package/dist/integrations/langchain-callback.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * LangChain.js callback handler that fires AgentGuard spend checks before
+ * every LLM call.
+ *
+ * Install: `npm install @agentguard-run/spend @langchain/core`
+ *
+ * @example
+ *   import { ChatOpenAI } from '@langchain/openai';
+ *   import { AgentGuardSpendCallbackHandler } from '@agentguard-run/spend/dist/integrations/langchain-callback';
+ *
+ *   const handler = new AgentGuardSpendCallbackHandler({
+ *     dailyCapDollars: 20,
+ *     agentId: 'my-langchain-agent',
+ *   });
+ *   const llm = new ChatOpenAI({ callbacks: [handler] });
+ *   await llm.invoke('hello');  // throws AgentGuardBlockedError if cap exceeded
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentGuardSpendCallbackHandler = void 0;
+const policy_1 = require("../policy");
+const store_memory_1 = require("../store-memory");
+const cost_table_1 = require("../cost-table");
+const spend_guard_1 = require("../spend-guard");
+function dollarsToCents(amount) {
+    return Math.round(amount * 100);
+}
+/**
+ * LangChain.js BaseCallbackHandler-compatible class. We declare it without
+ * extending the real BaseCallbackHandler (which would require a peer-dep
+ * import at module load), and let LangChain duck-type it via the standard
+ * callback method names.
+ */
+class AgentGuardSpendCallbackHandler {
+    name = 'agentguard_spend';
+    policy;
+    scope;
+    spendStore;
+    constructor(opts) {
+        const tenant = opts.tenantId ?? 'langchain-default';
+        const agent = opts.agentId ?? 'langchain-agent';
+        const caps = [];
+        if (opts.softCapDollars !== undefined && opts.downgradeTo !== undefined) {
+            caps.push({
+                amountCents: dollarsToCents(opts.softCapDollars),
+                window: 'per_day',
+                action: 'downgrade',
+                downgradeTo: opts.downgradeTo,
+                reason: `Soft daily cap, routing to ${opts.downgradeTo}`,
+            });
+        }
+        caps.push({
+            amountCents: dollarsToCents(opts.dailyCapDollars),
+            window: 'per_day',
+            action: 'block',
+            reason: `Hard daily ceiling ($${opts.dailyCapDollars.toFixed(2)}/day)`,
+        });
+        if (opts.perMinuteCapDollars !== undefined) {
+            caps.push({
+                amountCents: dollarsToCents(opts.perMinuteCapDollars),
+                window: 'per_minute',
+                action: 'block',
+                reason: `Per-minute burst guard ($${opts.perMinuteCapDollars.toFixed(2)}/min)`,
+            });
+        }
+        this.policy = {
+            id: `langchain-${tenant}-v1`,
+            name: `LangChain policy (${tenant})`,
+            scope: { tenantId: tenant },
+            caps,
+            mode: 'enforce',
+            version: 1,
+            effectiveFrom: new Date().toISOString(),
+        };
+        this.scope = { tenantId: tenant, agentId: agent };
+        this.spendStore = new store_memory_1.InMemorySpendStore();
+    }
+    // LangChain callback method
+    async handleChatModelStart(llm, messages, _runId, _parentRunId, extraParams) {
+        const model = (extraParams?.invocation_params?.model
+            || extraParams?.invocation_params?.model_name
+            || llm?.id?.[llm.id.length - 1]
+            || 'unknown');
+        const inputChars = JSON.stringify(messages).length;
+        await this.preflight({
+            model,
+            inputTokens: Math.max(1, Math.floor(inputChars / 4)),
+            outputTokens: extraParams?.invocation_params?.max_tokens || 1024,
+        });
+    }
+    async handleLLMStart(_llm, prompts, _runId, _parentRunId, extraParams) {
+        const model = (extraParams?.invocation_params?.model
+            || extraParams?.invocation_params?.model_name
+            || 'unknown');
+        await this.preflight({
+            model,
+            inputTokens: Math.max(1, Math.floor(prompts.join('').length / 4)),
+            outputTokens: extraParams?.invocation_params?.max_tokens || 1024,
+        });
+    }
+    async preflight(args) {
+        const provider = (0, cost_table_1.inferProvider)(args.model);
+        const call = {
+            provider,
+            model: args.model,
+            inputTokens: args.inputTokens,
+            outputTokens: args.outputTokens,
+            scope: this.scope,
+        };
+        const decision = await (0, policy_1.evaluatePolicy)(this.policy, call, this.spendStore);
+        if (decision.action === 'block') {
+            // Optionally sign + persist before throwing. Skipped here for latency.
+            throw new spend_guard_1.AgentGuardBlockedError(decision, this.scope);
+        }
+    }
+}
+exports.AgentGuardSpendCallbackHandler = AgentGuardSpendCallbackHandler;
+//# sourceMappingURL=langchain-callback.js.map

package/dist/integrations/langchain-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain-callback.js","sourceRoot":"","sources":["../../src/integrations/langchain-callback.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,sCAA2C;AAC3C,kDAAqD;AACrD,8CAA8C;AAC9C,gDAAwD;AAkBxD,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAa,8BAA8B;IACzC,IAAI,GAAG,kBAAkB,CAAC;IAClB,MAAM,CAAc;IACpB,KAAK,CAAa;IAClB,UAAU,CAAqB;IAEvC,YAAY,IAA2C;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC;QAEhD,MAAM,IAAI,GAAe,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC;gBACR,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;gBAChD,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,WAAW;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,8BAA8B,IAAI,CAAC,WAAW,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC;YACR,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;YACjD,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,wBAAwB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SACvE,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC;gBACR,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBACrD,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,4BAA4B,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACZ,EAAE,EAAE,aAAa,MAAM,KAAK;YAC5B,IAAI,EAAE,qBAAqB,MAAM,GAAG;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC3B,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,iCAAkB,EAAE,CAAC;IAC7C,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,oBAAoB,CACxB,GAAQ,EACR,QAAiB,EACjB,MAAc,EACd,YAAgC,EAChC,WAAiC;QAEjC,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK;eAC/C,WAAW,EAAE,iBAAiB,EAAE,UAAU;eAC1C,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;eAC5B,SAAS,CAAW,CAAC;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACpD,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,IAAI,IAAI;SACjE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,IAAS,EACT,OAAiB,EACjB,MAAc,EACd,YAAgC,EAChC,WAAiC;QAEjC,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK;eAC/C,WAAW,EAAE,iBAAiB,EAAE,UAAU;eAC1C,SAAS,CAAW,CAAC;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,IAAI,IAAI;SACjE,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAkE;QACxF,MAAM,QAAQ,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAgB;YACxB,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF,MAAM,QAAQ,GAAkB,MAAM,IAAA,uBAAc,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzF,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,oCAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF;AAtGD,wEAsGC"}

package/dist/store-memory.d.ts

@@ -12,6 +12,13 @@
  * and an additional application filed May 2026).
  */
 import type { SpendStore, SpendWindow } from './types';
+export declare const WINDOW_DURATION_MS: Record<SpendWindow, number>;
+/**
+ * Returns the millisecond timestamp at which a window of the given duration
+ * containing `nowMs` started. For fixed-grid windows we align to UTC epoch
+ * (so all processes agree on window boundaries without coordination).
+ */
+export declare function windowStart(window: SpendWindow, nowMs: number): number;
 /**
  * In-memory spend store. Thread-safe in single-process Node (we rely on the
  * event loop's atomic execution between awaits; this store does no I/O).

package/dist/store-memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-memory.d.ts","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AA4BvD;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,KAAK,CAAkC;IAE/C,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,WAAW;IAYb,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAKtE,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAMlB,oCAAoC;IACpC,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"store-memory.d.ts","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AASvD,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAM1D,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItE;AAED;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,KAAK,CAAkC;IAE/C,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,WAAW;IAYb,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAKtE,oBAAoB,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAMlB,oCAAoC;IACpC,KAAK,IAAI,IAAI;CAGd"}

package/dist/store-memory.js

@@ -13,8 +13,9 @@
  * and an additional application filed May 2026).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InMemorySpendStore = void 0;
-const WINDOW_DURATION_MS = {
+exports.InMemorySpendStore = exports.WINDOW_DURATION_MS = void 0;
+exports.windowStart = windowStart;
+exports.WINDOW_DURATION_MS = {
     per_call: 0, // per_call windows reset on every read
     per_minute: 60_000,
     per_hour: 3_600_000,
@@ -27,7 +28,7 @@ const WINDOW_DURATION_MS = {
  * (so all processes agree on window boundaries without coordination).
  */
 function windowStart(window, nowMs) {
-    const dur = WINDOW_DURATION_MS[window];
+    const dur = exports.WINDOW_DURATION_MS[window];
     if (dur === 0)
         return nowMs; // per_call is trivial
     return Math.floor(nowMs / dur) * dur;

package/dist/store-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-memory.js","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAWH,MAAM,kBAAkB,GAAgC;IACtD,QAAQ,EAAE,CAAC,EAAE,uCAAuC;IACpD,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,sEAAsE;CACnG,CAAC;AAEF;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAmB,EAAE,KAAa;IACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,sBAAsB;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAa,kBAAkB;IACrB,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEvC,GAAG,CAAC,QAAgB,EAAE,MAAmB;QAC/C,OAAO,GAAG,QAAQ,KAAK,MAAM,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,MAAmB,EAAE,KAAa;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAmB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,MAAmB,EACnB,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACrB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,oCAAoC;IACpC,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AAtCD,gDAsCC"}
+{"version":3,"file":"store-memory.js","sourceRoot":"","sources":["../src/store-memory.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAwBH,kCAIC;AAjBY,QAAA,kBAAkB,GAAgC;IAC7D,QAAQ,EAAE,CAAC,EAAE,uCAAuC;IACpD,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,UAAU;IACnB,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,sEAAsE;CACnG,CAAC;AAEF;;;;GAIG;AACH,SAAgB,WAAW,CAAC,MAAmB,EAAE,KAAa;IAC5D,MAAM,GAAG,GAAG,0BAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,sBAAsB;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAa,kBAAkB;IACrB,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEvC,GAAG,CAAC,QAAgB,EAAE,MAAmB;QAC/C,OAAO,GAAG,QAAQ,KAAK,MAAM,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,MAAmB,EAAE,KAAa;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAmB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,MAAmB,EACnB,KAAa;QAEb,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACrB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,oCAAoC;IACpC,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AAtCD,gDAsCC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentguard-run/spend",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Local-runtime spend caps and capability-gated model routing for AI agents. Prompts, API keys, and signing keys stay inside the customer runtime. Zero data plane involvement.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -72,12 +72,20 @@
   "peerDependencies": {
     "openai": ">=5.0.0",
     "@anthropic-ai/sdk": ">=0.30.0",
-    "@aws-sdk/client-bedrock-runtime": ">=3.600.0"
+    "@aws-sdk/client-bedrock-runtime": ">=3.600.0",
+    "ioredis": ">=5.0.0",
+    "pg": ">=8.10.0",
+    "@aws-sdk/client-kms": ">=3.600.0",
+    "@langchain/core": ">=0.3.0"
   },
   "peerDependenciesMeta": {
     "openai": { "optional": true },
     "@anthropic-ai/sdk": { "optional": true },
-    "@aws-sdk/client-bedrock-runtime": { "optional": true }
+    "@aws-sdk/client-bedrock-runtime": { "optional": true },
+    "ioredis": { "optional": true },
+    "pg": { "optional": true },
+    "@aws-sdk/client-kms": { "optional": true },
+    "@langchain/core": { "optional": true }
   },
   "devDependencies": {
     "@types/node": "^20.0.0",